search

Xabaril / AspNetCore.Diagnostics.HealthChecks

Enterprise HealthChecks for ASP.NET Core Diagnostics Package
Apache License 2.0
3.98k stars 770 forks source link

HealthChecks.OpenIdConnectServer doesn't support PS256 algorithm #2237

Open giovagnoli-formiris opened 2 weeks ago

giovagnoli-formiris commented 2 weeks ago

What happened: After migrating from Net6 to Net8 AspNetCore.HealthChecks.OpenIdConnectServer reports the following issue : "description": "Invalid discovery response - 'id_token_signing_alg_values_supported' must contain the following values: RS256!",

What you expected to happen: result should be Healthy as our idserver uses PS256 Algorithm.

This is confirmed by our discovery document : 

 "id_token_signing_alg_values_supported": [
    "PS256"
  ],

and our jwks endpoint : {"keys":[{"kty":"RSA","use":"sig","kid":"XXXX","alg":"PS256"}]}

How to reproduce it (as minimally and precisely as possible): Use our discovery document : services.AddHealthChecks() .AddIdentityServer( idSvrUri: new Uri("https://si30-staging-sso-web.azurewebsites.net")

Or Use your own Duende server where you'll implement ISigningCredentialStore with PS256

public async Task<SigningCredentials> ISigningCredentialStore.GetSigningCredentialsAsync()
{

    var key = [...]
    return new SigningCredentials(key, SecurityAlgorithms.RsaSsaPssSha256);
}